Linux Kernel up to 5.4.1 fs/io-wq.c Request privileges management

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.4.1 and classified as critical. The affected element is an unknown function of the file fs/io-wq.c. Executing a manipulation as part of Request can lead to privileges management. This vulnerability is registered as CVE-2019-19241. The attack needs to be launched locally. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 5.4.1 (Operating System). This vulnerability affects an unknown code of the file fs/io-wq.c. The manipulation as part of a Request leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.

The weakness was published 12/17/2019. This vulnerability was named CVE-2019-19241 since 11/25/2019. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 5.4.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47779). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.0
• 5.4.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion